As the question title suggests I am looking at the best way of locking down Courier so that it can only be used to migrate edited/created content including media items. Basically we don't want templates, macros, document types or anything which has to do with structure rather than content being included as a dependency during the packaging process. We just want any changes to content property values which may include images in RTE's and therefore their related media items as any changes to the Umbraco structure should be handled by a seperate deployment process.

Is it as simple as ticking the 'Deny usage' checkbox for everything apart from Documents, Media and maybe Folders and Files?

I see there is also a config element to ignore certain file locations so would adding entries to the masterpages/*.master and macroscripts/*.cshtml files also be required?